Re: FC3: no route to host with enabled firewall

same, no route to host again. if i switch iptables off, everything works. in fc2 probably same setting in /etc/sysconfig/iptables without problem... :(
M.Holubec

[root@mYr0Ch myroch]# cat /etc/sysconfig/iptables
# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT


Doncho N. Gunchev napsal(a):

On 2004 12 08 (Wednesday) 15:38, Miroslav Holubec wrote:

Hi,
i've problem with my firewall. i think that, it filter my outgoing
packets. if i enable firewall in system-config-securitylevel, then a lot
of my outgoing connections are filtered.
for example:

[user@comp ~]$ ftp 1.2.3.4
Connected to 1.2.3.4.
220 (vsFTPd 1.2.1)
530 Please login with USER and PASS.
530 Please login with USER and PASS.
Name (1.2.3.4:user): user
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (1,2,3,4,43,196)
ftp: connect: No route to host
ftp> passive
Passive mode off.
ftp> ls
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
(no reply for a long time)

I have to use passive mode, becouse i'm behind another hw firewall. In
FC2 i haven't problem with that. i was trying to search some
informations on google, but i wasn't lucky.

thank you for some advice.

M.Holubec

    In /etc/sysconfig/iptables-config try setting
IPTABLES_MODULES="ip_nat_ftp ip_conntrack_ftp"
    and restart iptables.